.env.example

# Supabase Configuration (Server-side only)
SUPABASE_URL=https://your-project.supabase.co
# Secret key from Supabase Dashboard > Settings > API > Secret key (sb_secret_...)
# This is the server-side key - NEVER expose to client
SUPABASE_SERVICE_ROLE_KEY=sb_secret_your-secret-key
# Publishable key from Supabase Dashboard > Settings > API > Publishable key (sb_publishable_...)
SUPABASE_ANON_KEY=sb_publishable_your-publishable-key
SUPABASE_DB_PASSWORD=your-db-password

# Public Supabase keys (safe for client)
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
# Same as SUPABASE_ANON_KEY - publishable key is safe for client
NEXT_PUBLIC_SUPABASE_ANON_KEY=sb_publishable_your-publishable-key

# Application Configuration
NEXT_PUBLIC_APP_URL=https://bittorrented.com
NEXT_PUBLIC_APP_NAME=BitTorrented

# Torrent Configuration
# Timeout for fetching torrent metadata in milliseconds (default: 60000 = 60 seconds)
# Increase this if torrents with few seeders are timing out
TORRENT_METADATA_TIMEOUT_MS=60000
MAX_CONCURRENT_STREAMS=100

# Rate Limiting
RATE_LIMIT_ENABLED=true
RATE_LIMIT_MAGNET_PER_MINUTE=10
RATE_LIMIT_SEARCH_PER_MINUTE=60
RATE_LIMIT_STREAM_CONCURRENT=5

# FFmpeg Transcoding (Optional)
# Set to true to enable server-side transcoding for unsupported formats
FFMPEG_ENABLED=false
FFMPEG_PATH=/usr/bin/ffmpeg

# Metadata APIs
# OMDb API key for movies and TV shows (get free key at https://www.omdbapi.com/apikey.aspx)
OMDB_API_KEY=your-omdb-api-key
# TheTVDB API key for trending TV shows and movies (get free key at https://thetvdb.com/api-information)
THETVDB_API_KEY=your-thetvdb-api-key
# Fanart.tv API key for high-quality posters and artist images (get free key at https://fanart.tv/get-an-api-key/)
FANART_TV_API_KEY=your-fanart-api-key
# TMDB API key for movie/TV metadata in DHT crawler (get free key at https://www.themoviedb.org/settings/api)
TMDB_API_KEY=your-tmdb-api-key
MUSICBRAINZ_USER_AGENT=BitTorrented/1.0.0 (https://bittorrented.com)

# CoinPayPortal (Crypto Payments)
# Get these from your CoinPayPortal dashboard: https://coinpayportal.com/dashboard
COINPAYPORTAL_API_KEY=cp_live_your_api_key
NEXT_PUBLIC_COINPAYPORTAL_MERCHANT_ID=your-merchant-uuid
COINPAYPORTAL_WEBHOOK_SECRET=your-webhook-secret
# Optional: CoinPayPortal OAuth/OIDC base URL for bearer-token RSS feed auth
COINPAYPORTAL_OAUTH_BASE_URL=https://coinpayportal.com
# Optional: Override API URL for testing
# COINPAYPORTAL_API_URL=https://coinpayportal.com/api

# Subscription Plans (in cents)
PREMIUM_PLAN_PRICE_CENTS=499
FAMILY_PLAN_PRICE_CENTS=999
FAMILY_ADDITIONAL_SEAT_PRICE_CENTS=200

# Resend Email Configuration
# Get your API key from: https://resend.com/api-keys
RESEND_API_KEY=re_your_resend_api_key
# Email sender address (must be verified in Resend)
EMAIL_FROM=noreply@yourdomain.com
# Display name for email sender
EMAIL_FROM_NAME=BitTorrented

# SMTP account credential encryption
# Required for storing user-configured SMTP usernames/passwords. Generate with: openssl rand -base64 32
ENCRYPTION_KEY=change-this-smtp-credential-key

# Supabase Management API (for email template updates)
# Get project ref from your Supabase URL: https://supabase.com/dashboard/project/<PROJECT_REF>
SUPABASE_PROJECT_REF=your-project-ref
# Generate access token at: https://supabase.com/dashboard/account/tokens
SUPABASE_ACCESS_TOKEN=your-supabase-access-token

# Server Setup (used by scripts/setup-server.sh)
# System user for the service (default: ubuntu)
# Common values: ubuntu (DigitalOcean, AWS), admin (Linode), root (some providers)
VPS_USER=ubuntu
# Email for Let's Encrypt SSL certificate notifications
CERTBOT_EMAIL=admin@bittorrented.com
# SSH port for firewall configuration (default: 22)
# Change this if you've configured a non-standard SSH port for security
SSH_PORT=22
# Set to 1 to force SSL setup even if DNS check fails
# FORCE_SSL=1

# ── Seedbox: push torrents from the app to your seedbox ─────────────────────
# Only these emails may push to the seedbox (comma-separated). Leave empty to
# disable the whole feature — it fails closed.
SEEDBOX_ALLOWED_EMAILS=
#
# Transport 1 — HTTP API (torlink's `torlnk serve`, default :9161). Both base
# URL and token are required for this transport to activate.
SEEDBOX_HTTP_BASE_URL=http://your-seedbox.example.com:9161
SEEDBOX_HTTP_TOKEN=your-torlink-api-token
# Path the magnet is POSTed to (default: /add — matches torlnk serve)
SEEDBOX_HTTP_ADD_PATH=/add
# Auth style: "bearer" (Authorization: Bearer <token>) or "header:<Name>"
# e.g. "header:X-Api-Key" sends the token in an X-Api-Key header. Default: bearer
SEEDBOX_HTTP_AUTH=bearer
# JSON field carrying the magnet in the POST body (default: magnet)
SEEDBOX_HTTP_MAGNET_FIELD=magnet
#
# Transport 2 — SSH. Requires host + user + a key + one delivery mode below.
SEEDBOX_SSH_HOST=
SEEDBOX_SSH_PORT=22
SEEDBOX_SSH_USER=seedbox-mgr
# Provide the private key material directly, OR a path to a key file on the server.
# The matching public key (shown in the UI / via GET the seedbox route) goes in
# the seedbox's ~/.ssh/authorized_keys.
SEEDBOX_SSH_PRIVATE_KEY=
SEEDBOX_SSH_PRIVATE_KEY_PATH=
# Delivery mode A — drop a <name>.magnet file into a watch/blackhole dir:
SEEDBOX_SSH_WATCH_DIR=
# Delivery mode B — run a command on the box; {magnet}/{name} are substituted
# (shell-quoted). Used only when no watch dir is set. e.g. torlink add {magnet}
SEEDBOX_SSH_ADD_COMMAND=
#
# Play from seedbox — point at the seedbox file server (torlink's `torlnk files`,
# default :9160) that serves completed downloads. Files stream from
# <base>/<torrent-relative-path>, proxied server-side so the token isn't exposed.
# Leave base URL empty to disable the "Play from seedbox" toggle.
SEEDBOX_FILES_BASE_URL=http://your-seedbox.example.com:9160
# Auth: none (default) | bearer | header:X-Name | basic
SEEDBOX_FILES_AUTH=none
SEEDBOX_FILES_TOKEN=
SEEDBOX_FILES_BASIC_USER=
SEEDBOX_FILES_BASIC_PASS=

# Redis Configuration (for IPTV playlist caching)
# Required for Live TV feature - caches M3U playlists for 5 minutes
# Local development: docker run -d -p 6379:6379 redis:alpine
REDIS_URL=redis://localhost:6379

# ArgonTV IPTV Reseller API
# Get these from your ArgonTV distributor dashboard: https://distributors.argontv.nl
IPTV_ARGON_API_KEY=your-argontv-api-key
IPTV_ARGON_API_BASE_URL=https://distributors.argontv.nl
# Template ID for "everything" package (get from ArgonTV dashboard)
IPTV_ARGON_TEMPLATE_ID=12345

# Web Push Notifications (VAPID Keys)
# Required for podcast new episode notifications
# Generate keys with: pnpm tsx scripts/generate-vapid-keys.ts
# VAPID keys identify your server to push services (Google FCM, Mozilla, Apple)
VAPID_PUBLIC_KEY=your-vapid-public-key
VAPID_PRIVATE_KEY=your-vapid-private-key
VAPID_SUBJECT=mailto:admin@bittorrented.com

# TURN/STUN Server Configuration (Coturn)
# Required for WebTorrent P2P streaming through firewalls/NAT
# The TURN server relays traffic when direct P2P connections fail
# Generate a secure secret: openssl rand -hex 32
TURN_SECRET=change-this-secret-in-production
# Your server's public domain for TURN
TURN_REALM=bittorrented.com
# Your server's public IP address (required for TURN to work)
# Get this from your VPS provider or run: curl -s ifconfig.me
TURN_EXTERNAL_IP=
# Public URL for clients to connect to TURN server
# This should match your server's domain or IP
NEXT_PUBLIC_TURN_SERVER_URL=turn:bittorrented.com:3478
# Credential TTL in seconds (default: 24 hours)
TURN_CREDENTIAL_TTL=86400

# Server Port (set automatically in production)
# PORT=3000

THENEWSAPI_API_KEY=your-thenewsapi-api-key
OPENAI_API_KEY=your-openai-api-key

# Finance section (/finance)
# Finnhub provides real-time US quotes + symbol search (free tier). Candles fall
# back to keyless Stooq EOD when Finnhub's free plan blocks /stock/candle.
# Get a key at https://finnhub.io/dashboard
FINNHUB_API_KEY=your-finnhub-api-key
# Alpaca app-level keys for market-data candles (getBarsV2, free IEX feed).
# Per-user broker connections supply their OWN keys via the /finance connect UI.
ALPACA_API_KEY=your-alpaca-api-key
ALPACA_API_SECRET=your-alpaca-api-secret
# Optional: override the AI report model (defaults to gpt-5.5)
# FINANCE_OPENAI_MODEL=gpt-5.5
# Optional: per-user and global daily caps on AI report generations
# FINANCE_REPORTS_PER_USER_PER_DAY=10
# FINANCE_REPORTS_GLOBAL_PER_DAY=200

# SiriusXM API
# Each user connects their own SiriusXM account from /radio (email + OTP).
# Per-user tokens persist in bt_siriusxm_sessions and refresh on demand when
# the radio API needs a fresh bearer token.
#
# PROXY_URL — outbound HTTP proxy used for ALL api.edge-gateway.siriusxm.com
#   requests AND the headless-browser DEVICE_GRANT mint. Required because
#   datacenter IPs are blocked at SXM's edge gateway. Webshare residential-
#   rotate works.
PROXY_URL=

# YouTube / Google OAuth
# Required for /youtube search, subscribed-channel browsing, and subscription
# subscribe/unsubscribe actions. Each user connects their own Google account
# (OAuth 2.0) and tokens persist in bt_youtube_accounts. Without these set,
# token refresh fails and YouTube API routes return 502.
#
# 1. Create OAuth client at https://console.cloud.google.com/apis/credentials
# 2. Enable YouTube Data API v3 for the project
# 3. Add scope: https://www.googleapis.com/auth/youtube.force-ssl (and openid/email/profile)
#    Existing readonly-only accounts must reconnect before they can manage subscriptions.
# 4. Set redirect URI to <NEXT_PUBLIC_APP_URL>/api/youtube/auth/callback
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_OAUTH_REDIRECT_URI=https://your-host/api/youtube/auth/callback

# DHT Crawler (Bitmagnet + DHT Search API)
# Uses existing SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, SUPABASE_DB_PASSWORD
# Set to false to skip DHT services installation during setup
DHT_ENABLED=true
DHT_CRAWLER_SCALING_FACTOR=10
DHT_QUEUE_CONCURRENCY=10
DHT_API_PORT=8081
# Salt for hashing API keys (generate with: openssl rand -hex 16)
DHT_API_KEY_SALT=your-random-32-char-string

ELEVENLABS_API_KEY=your-elevenlabs-api-key